It's important to notify impacted individuals as soon as possible. Early notification will allow individuals whose personal information may have been compromised to take steps to mitigate misuse of their information. Most states have their own laws and rules that address when and how to notify individuals of a compromise of their data. Contact your attorney for guidance regarding your obligations to your clients and others who may have been impacted.
Also see the Federal Trade Commission guidance page: Information Compromise and the Risk of Identity Theft: Guidance for Your Business here.
We have sample Notification Letters that may be used to draft a notice to all clients about the unauthorized disclosure (available upon request), which you may wish to review with your counsel.
Additional steps you can take to help your clients:
To help protect your clients from the impacts of identity theft, you can offer them credit monitoring through a third-party credit monitoring provider.
You can also ask your IRS Stakeholder Liaison about obtaining identity protection PINs for all of your clients. For more information, visit the IRS website here.
Steps your clients can take:
To mitigate the impacts of identity theft, you can advise your clients to take these initial steps:
- Enact a credit freeze or put a fraud alert on their credit reports;
- Obtain a copy of their credit reports;
- Create an identity theft report by filing an identity theft complaint with the FTC and filing a police report.
- For more information about credit freezes and fraud alerts see here.
- The FTC provides more tips for consumers dealing with tax-related identity theft here.